QNAP Systems HBS 3 Hybrid Backup Sync 安全漏洞

QNAP Systems HBS 3 Hybrid Backup Sync is a backup and synchronization tool from QNAP Systems Taiwan, China. A security vulnerability exists in QNAP Systems HBS 3 Hybrid Backup Sync that originates from external control of file names or paths, which could result in reading or modifying files or...

Directory Traversal

Overview chainlit is a Build Conversational AI. Affected versions of this package are vulnerable to Directory Traversal via the updatethreadelement and deletethreadelement handlers in backend/chainlit/server.py. An authenticated attacker can read arbitrary files from the server by sending a craft...

Incorrect Permission Assignment for Critical Resource

Overview Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource when handling attachments. An attacker can modify or delete files belonging to other users by sending crafted requests with low-level privileges. Remediation Upgrade...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

CVE-2025-58097

The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the installation directory and execute arbitrary code with the administrative privilege...

PT-2025-47666

Name of the Vulnerable Software and Affected Versions LogStare Collector affected versions not specified Description The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the installation directory a...

CVE-2025-36357

IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing absolute path sequences to view, read, or write arbitrary files on the system...

Synology Contacts for DSM 跨站脚本漏洞

Synology Contacts for DSM is a contact server provided by the Chinese company Synology. There is a security vulnerability in Synology Contacts for DSM, which allows attackers to bypass access restrictions and read or modify files...

Malicious code in typeorm-csv-troposphere-socketio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e73547aa88679589280af7f97832cc643441c415a7b0c69aa00448db76023b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187143 Malicious code in gemini-query-adonis-request (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88dc675516f0b833eb0fe5dc36d4860582128956738b97d038115774134b5bf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181617 Malicious code in astam-ifit-dabzai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9079b408c8588105c56db9d5b6f660fd8dd844abd6ad448e4620f9c83670e7eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-172769 Malicious code in alvino-20 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2046bdc1d9658658cbc26e65152a21ae040284ca04af748feef8f2d1cde8a57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177642 Malicious code in polymer-afaj-rofidsfafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62053a4159d941e308b6e40ce74c80522315fdc891cef02a3a977523a4e2b985 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177797 Malicious code in polymer-avafifa-fagsabaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458b9c7eda63f5f6a1bad3872e11d23d8b067eaae0dd6a4a3f89aceba8e498c7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nokire-nakala40 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeddb62a33315800a1caa8cc8d3842c532b7ca1c8237d1c8058a674a88aef572 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in saku-aimau-upuasanmio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f21e54cc212c9c095463fd8627ca49d6c2dfabeab030b28514319b2446f0cab3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166472 Malicious code in sunderlan-uylud-vamuiusabavasiknauin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90b735e32610965623368fb5f122855679c6dc8c72d3c27dcec588a3e03fcb8f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in morgan-warp-gacrux-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a5669875c0e01775ff49e5731dec424fd931df475451a47ff37a2f982d8829 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sedna-pino-semantic-ui-unuk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0375a5c9197ee371bf131bdbf40740f8aaffba603a8d2704f59bc7590699c75c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in tania-takokak72-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77e081668a8b3d3af1fb428929750452b6438bc1e29c0830815432fe3cf2adf9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...